Compensating Controls for a Legacy System?

SY0-701 By islever Editorial Last updated

Compare and contrast various types of security controls. Given a scenario, select mitigation techniques or controls to secure an enterprise environment.

Short answer

D Disabling unneeded services and placing a firewall in front of a business-critical legacy system are compensating controls that mitigate unpatched-system risk.

Question

An organization disabled unneeded services and placed a firewall in front of a business-critical legacy system. Which of the following best describes the actions taken by the organization?
  1. Exception
  2. Segmentation
  3. Risk transfer
  4. Compensating controls Correct Answer

Key Takeaways

The question tests whether you can identify compensating controls implemented around an unpatchable legacy system, and the trap is choosing segmentation merely because a firewall sits in front of the host.

Disabling unneeded services and placing a firewall in front of a business-critical legacy system are compensating controls: alternative safeguards used when the system cannot be patched or hardened normally. This page confirms D is the best answer over segmentation, exception, and risk transfer, with expert analysis and community consensus.

Common mistake: The most common wrong answer is B (segmentation), because a firewall in front of a legacy system sounds like network isolation; however, the scenario emphasizes mitigating the legacy system's unpatched risk with alternative safeguards, not dividing the network into segments.

Expert Analysis

Why the Answer Is Correct

The organization is dealing with a business-critical legacy system that likely cannot be patched, upgraded, or hardened to current standards, so it applies alternative safeguards: disabling unneeded services to shrink the attack surface and placing a firewall in front of it to filter traffic. These are classic compensating controls, because they compensate for the missing primary controls (vendor patches, modern OS hardening) without changing the legacy system itself. CompTIA SY0-701 defines compensating controls as alternate controls deployed when the primary control is infeasible, which matches the scenario exactly. The firewall and service-disablement are not the ideal long-term fix, but they reduce risk to an acceptable level while the legacy system remains in production.

Why the Other Options Are Wrong

Segmentation (B) would mean dividing the network into isolated zones and controlling traffic between them; a firewall can support segmentation, but the question's focus is on compensating for the legacy host's weaknesses, not on creating network segments. An exception (A) is a documented policy deviation, such as allowing a legacy system to bypass a patching standard, but the organization here is adding controls rather than granting an exemption. Risk transfer (C) means shifting financial impact to a third party, typically through insurance or outsourcing, and nothing in the scenario indicates a third party accepted the risk. Compensating controls (D) is the only option that describes both actions as risk-mitigation alternatives for an unsupported system.

Community Comment Notes

Most learners converged on D, with Th3irdEye noting that the word "legacy" should signal a compensating control, and Etc_Shadow28000 explaining that disabling services and adding a firewall mitigate risks when primary controls are not feasible. dbrowndiver similarly described the actions as alternative controls that enhance security without changing the legacy system. CyberPark17 dissented, arguing B is the action taken while D is the result, but that reasoning conflates a possible implementation detail with the best description of the organization's intent. EngAbood's short "Legacy = Compensating" summarizes the community's practical heuristic. The consensus, supported by CompTIA's control taxonomy, is D.

Official Reference

https://www.comptia.org/certifications/security

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a scenario mentions a legacy, unsupported, or unpatchable system and then lists added safeguards, think compensating controls rather than segmentation. Ask whether the organization is dividing the network (segmentation) or working around a primary control that cannot be applied (compensation).

Frequently Asked Questions

Why is segmentation not the best answer when a firewall is placed in front of a legacy system?

The firewall may isolate traffic, but the scenario's intent is to compensate for the legacy system's unpatched weaknesses with alternative controls, not to create network segments (B).

What makes disabling unneeded services a compensating control rather than standard hardening?

On a legacy system that cannot be patched or upgraded, disabling services is an alternative safeguard that reduces attack surface where the primary control—vendor-supported hardening—is not feasible.

More SY0-701 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. Th3irdEye 👍 10 Answered D
    The word "legacy" should inform that this action is compensating.
  2. Etc_Shadow28000 👍 8 Answered D
    D. Compensating controls The actions taken by the organization—disabling unneeded services and placing a firewall in front of a business-critical legacy system—are examples of compensating controls. Compensating controls are security measures that are implemented to mitigate risk when the primary controls are not feasible or sufficient. In this case, since the legacy system might have inherent vulnerabilities that cannot be fully addressed, the organization has implemented additional controls to reduce the risk. Therefore, the correct answer is: D. Compensating controls
  3. dbrowndiver 👍 2 Answered D
    Compensating controls is the best choice because the actions taken by the organization are intended to mitigate the risks associated with a legacy system when more standard security measures cannot be applied. By implementing these alternative controls, the organization effectively enhances the security of the legacy system without requiring direct updates or changes to its structure.
  4. johnsongr8 👍 2
    The actions taken by the organization best describe D. Compensating controls. These measures are implemented to mitigate potential risks associated with the legacy system, ensuring its security despite inherent vulnerabilities.
  5. SHADTECH123 👍 1 Answered D
    Compensating controls are alternative measures implemented to mitigate the risk of a vulnerability when the primary controls cannot be applied. In this scenario, the organization has: Disabled unneeded services: This reduces the attack surface of the legacy system, limiting potential vulnerabilities. Placed a firewall in front of the system: This provides an additional layer of security, controlling and monitoring the traffic to and from the legacy system.
Show 6 more comments
  1. G3O 👍 1 Answered D
    By implementing compensating controls (disabling unneeded services and using a firewall), the organization is mitigating the risks associated with the legacy system in the absence of being able to fully secure it through traditional means.
  2. deejay2 👍 1
    Segmentation means seperate, you're not seperating anything. You're disabling one thing and inputting something else to implement additional security. D is correct.
  3. CyberPark17 👍 1 Answered B
    best describes the "actions taken"?? Segmentation is the action taken by the organisation to have Compensating controls. B is the corect answer. Hope that helps.
  4. networkmen 👍 1 Answered D
    It is a business critical legacy system - i would go with D Dompensationg controls
  5. whatsupdeepak 👍 1
    D - Compensating controls
  6. EngAbood 👍 1 Answered D
    Legacy = Compensating

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide